@camstack/addon-training 0.1.22 → 0.1.23

package/dist/providers/modal/training-modal.addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("../../dist-Dd6EAdVX.js");
+const require_dist = require("../../dist-DwF1P1v7.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
@@ -11,14 +11,43 @@ let timers_promises = require("timers/promises");
 let node_console = require("node:console");
 let node_os = require("node:os");
 let node_stream = require("node:stream");
-//#region src/providers/modal/modal-entries.ts
+//#region src/providers/modal/entry-secret-view.ts
 /**
-* Modal provider entries — one credentials + defaults row per operator
-* account. Pure helpers so the store is unit-tested without BaseAddon.
+* Build the {@link SecretFieldView} the Providers edit form needs for an
+* entry's token secret.
 *
-* A pre-multi-entry config (flat tokenId/tokenSecret on the addon) migrates
-* to a single entry named {@link DEFAULT_MODAL_ENTRY_NAME}.
+* `readStoredGlobalKey` / `this.config` answer VALUES (D798), never markers —
+* so `toSecretFieldView(plaintext)` alone yields an inline view (`$secret:
+* null`) and `SecretFieldControl` cannot reveal. When the secret is set we
+* prefer the deterministic keychain ref (`ctx.secrets.ref`) so the eye can
+* call `keychain-admin.reveal` (D789).
 */
+/** View for one entry row, or `null` when nothing is stored. */
+function entryTokenSecretView(tokenSecret, secrets, entryId) {
+	if (require_dist.isSecretMarker(tokenSecret)) return require_dist.toSecretFieldView(tokenSecret);
+	const plain = typeof tokenSecret === "string" ? tokenSecret.trim() : "";
+	if (plain === "") return null;
+	if (secrets === void 0) return require_dist.toSecretFieldView(plain);
+	return {
+		$secret: secrets.ref(require_dist.globalSecretScope(), require_dist.arrayItemFieldPath("entries", entryId, "tokenSecret")),
+		v: 1,
+		set: true
+	};
+}
+/** View for the legacy flat `tokenSecret` (pre-multi-entry Default). */
+function flatTokenSecretView(tokenSecret, secrets) {
+	if (require_dist.isSecretMarker(tokenSecret)) return require_dist.toSecretFieldView(tokenSecret);
+	const plain = typeof tokenSecret === "string" ? tokenSecret.trim() : "";
+	if (plain === "") return null;
+	if (secrets === void 0) return require_dist.toSecretFieldView(plain);
+	return {
+		$secret: secrets.ref(require_dist.globalSecretScope(), "tokenSecret"),
+		v: 1,
+		set: true
+	};
+}
+//#endregion
+//#region src/providers/modal/modal-entries.ts
 var MODAL_TYPE_ID = "modal";
 var DEFAULT_MODAL_ENTRY_NAME = "Default";
 var MODAL_ICON_ASSET = "assets/training-modal/icon.svg";
@@ -29,22 +58,44 @@ var DEFAULT_GRACE = 24;
 function legacyConfigured(config) {
 	return (config.tokenId ?? "").trim() !== "" || (config.tokenSecret ?? "").trim() !== "";
 }
+/**
+* Keychain / secretStatePaths may omit an empty `tokenSecret` from a stored
+* row (writing `''` is KEEP, not "store empty"). Readers must never see
+* `undefined` and then call `.trim()`.
+*/
+function secretAsString(value) {
+	return typeof value === "string" ? value : "";
+}
+function normalizeModalEntry(entry) {
+	return {
+		id: entry.id,
+		name: entry.name ?? "Default",
+		tokenId: entry.tokenId ?? "",
+		tokenSecret: secretAsString(entry.tokenSecret),
+		environment: entry.environment ?? "",
+		gpuType: entry.gpuType ?? DEFAULT_GPU,
+		region: entry.region ?? "",
+		costCapUsd: entry.costCapUsd ?? DEFAULT_COST,
+		maxRuntimeHours: entry.maxRuntimeHours ?? DEFAULT_HOURS,
+		failedDatasetGraceHours: entry.failedDatasetGraceHours ?? DEFAULT_GRACE
+	};
+}
 /** Entries the operator sees — synthesises Default from legacy flat fields. */
 function effectiveModalEntries(config) {
-	if (config.entries.length > 0) return config.entries;
+	if (config.entries.length > 0) return config.entries.map((e) => normalizeModalEntry(e));
 	if (!legacyConfigured(config)) return [];
-	return [{
+	return [normalizeModalEntry({
 		id: "legacy-default",
 		name: DEFAULT_MODAL_ENTRY_NAME,
-		tokenId: config.tokenId ?? "",
-		tokenSecret: config.tokenSecret ?? "",
-		environment: config.environment ?? "",
-		gpuType: config.gpuType ?? DEFAULT_GPU,
-		region: config.region ?? "",
-		costCapUsd: config.costCapUsd ?? DEFAULT_COST,
-		maxRuntimeHours: config.maxRuntimeHours ?? DEFAULT_HOURS,
-		failedDatasetGraceHours: config.failedDatasetGraceHours ?? DEFAULT_GRACE
-	}];
+		tokenId: config.tokenId,
+		tokenSecret: config.tokenSecret,
+		environment: config.environment,
+		gpuType: config.gpuType,
+		region: config.region,
+		costCapUsd: config.costCapUsd,
+		maxRuntimeHours: config.maxRuntimeHours,
+		failedDatasetGraceHours: config.failedDatasetGraceHours
+	})];
 }
 function findModalEntry(config, entryId) {
 	return effectiveModalEntries(config).find((e) => e.id === entryId) ?? null;
@@ -381,7 +432,10 @@ var ModalTrainingProvider = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	describe = async () => this.deps.listEntries().map((entry) => this.descriptorOf(entry));
+	describe = async () => {
+		const views = await this.deps.secretViews();
+		return this.deps.listEntries().map((entry) => this.descriptorOf(entry, views.get(entry.id) ?? null));
+	};
 	describeTypes = async () => [{
 		typeId: MODAL_TYPE_ID,
 		label: "Modal",
@@ -397,10 +451,11 @@ var ModalTrainingProvider = class {
 	}));
 	createEntry = async (input) => this.deps.createEntry(input);
 	updateEntry = async (input) => {
+		const secret = input.tokenSecret === void 0 ? {} : require_dist.isSecretClear(input.tokenSecret) ? { clearTokenSecret: true } : input.tokenSecret === "" ? {} : { tokenSecret: input.tokenSecret };
 		await this.deps.updateEntry(input.entryId, {
 			name: input.name,
 			...input.tokenId !== void 0 ? { tokenId: input.tokenId } : {},
-			...input.tokenSecret !== void 0 ? { tokenSecret: input.tokenSecret } : {},
+			...secret,
 			...input.environment !== void 0 ? { environment: input.environment } : {},
 			...input.gpuType !== void 0 ? { gpuType: input.gpuType } : {},
 			...input.region !== void 0 ? { region: input.region } : {},
@@ -687,9 +742,12 @@ var ModalTrainingProvider = class {
 		}))];
 	};
 	entryConfigured(entry) {
-		return entry.tokenId.trim() !== "" && entry.tokenSecret.trim() !== "";
+		const secret = typeof entry.tokenSecret === "string" ? entry.tokenSecret : "";
+		return (entry.tokenId ?? "").trim() !== "" && secret.trim() !== "";
 	}
-	descriptorOf(entry) {
+	descriptorOf(entry, tokenSecretView) {
+		const tokenId = entry.tokenId ?? "";
+		const environment = entry.environment ?? "";
 		return {
 			addonId: this.deps.addonId,
 			entryId: entry.id,
@@ -706,15 +764,16 @@ var ModalTrainingProvider = class {
 			dataResidencyNote: "Modal keeps the frames on a Volume of your workspace for the length of the job; the training container sees them only while it runs.",
 			configured: this.entryConfigured(entry),
 			defaults: {
-				gpuType: entry.gpuType,
-				region: entry.region,
-				costCapUsd: entry.costCapUsd,
-				maxRuntimeSec: Math.round(entry.maxRuntimeHours * 3600),
-				failedDatasetGraceHours: entry.failedDatasetGraceHours
+				gpuType: entry.gpuType ?? "L4",
+				region: entry.region ?? "",
+				costCapUsd: entry.costCapUsd ?? 5,
+				maxRuntimeSec: Math.round((entry.maxRuntimeHours ?? 4) * 3600),
+				failedDatasetGraceHours: entry.failedDatasetGraceHours ?? 24
 			},
-			tokenId: entry.tokenId,
-			environment: entry.environment,
-			hasTokenSecret: entry.tokenSecret.trim() !== ""
+			tokenId,
+			environment,
+			hasTokenSecret: tokenSecretView !== null,
+			tokenSecretView
 		};
 	}
 	requireGateway(entryId) {
@@ -88588,9 +88647,15 @@ var TrainingModalAddon = class extends require_dist.BaseAddon {
 	}
 	async onInitialize() {
 		let next = this.config;
-		if (next.entries.length === 0) next = migrateLegacyModalConfig(next, () => (0, node_crypto.randomUUID)());
+		let migratedLegacy = false;
+		if (next.entries.length === 0) {
+			const migrated = migrateLegacyModalConfig(next, () => (0, node_crypto.randomUUID)());
+			migratedLegacy = migrated !== next;
+			next = migrated;
+		}
 		next = ensureModalEntryIds(next, () => (0, node_crypto.randomUUID)());
 		if (next !== this.config) await this.updateGlobalSettings(next);
+		if (migratedLegacy) await this.clearSecrets(["tokenSecret"]);
 		this.ledgerState = this.state(LEDGER_KEY, LedgerSchema, {});
 		const peer = this.ctx.peerBytes;
 		if (peer === void 0) throw new Error("training-modal needs the peer-bytes facility");
@@ -88606,17 +88671,27 @@ var TrainingModalAddon = class extends require_dist.BaseAddon {
 				return { entryId: result.entryId };
 			},
 			updateEntry: async (entryId, patch) => {
-				const result = updateModalEntry(this.config, entryId, patch);
+				const { clearTokenSecret, ...rest } = patch;
+				const result = updateModalEntry(this.config, entryId, rest);
 				if (!result.ok) throw new Error(`cannot update entry: ${result.reason}`);
-				await this.updateGlobalSettings(result.config);
+				if (clearTokenSecret === true) await this.updateGlobalSettings({
+					...result.config,
+					entries: result.config.entries.map((entry) => entry.id === entryId ? {
+						...entry,
+						tokenSecret: require_dist.SECRET_CLEAR
+					} : entry)
+				});
+				else await this.updateGlobalSettings(result.config);
 				this.closeGateway(entryId);
 			},
 			deleteEntry: async (entryId) => {
 				const result = deleteModalEntry(this.config, entryId);
 				if (!result.ok) throw new Error(`cannot delete entry: ${result.reason}`);
 				await this.updateGlobalSettings(result.config);
+				await this.clearSecrets(["tokenSecret"]);
 				this.closeGateway(entryId);
 			},
+			secretViews: () => this.readEntrySecretViews(),
 			ledger: this.ledger(),
 			peer,
 			fetchText,
@@ -88625,7 +88700,10 @@ var TrainingModalAddon = class extends require_dist.BaseAddon {
 		});
 		this.ctx.logger.info("Modal training provider ready", { meta: {
 			entries: effectiveModalEntries(this.config).length,
-			configured: effectiveModalEntries(this.config).some((e) => e.tokenId.trim() !== "" && e.tokenSecret.trim() !== "")
+			configured: effectiveModalEntries(this.config).some((e) => {
+				const secret = typeof e.tokenSecret === "string" ? e.tokenSecret : "";
+				return (e.tokenId ?? "").trim() !== "" && secret.trim() !== "";
+			})
 		} });
 		return { providers: [{
 			capability: require_dist.trainingProviderCapability,
@@ -88643,15 +88721,18 @@ var TrainingModalAddon = class extends require_dist.BaseAddon {
 	gatewayFor(entryId) {
 		const entry = findModalEntry(this.config, entryId);
 		if (entry === null) return null;
-		if (entry.tokenId.trim() === "" || entry.tokenSecret.trim() === "") return null;
-		const key = `${entry.tokenId}\u0000${entry.environment}`;
+		const tokenId = (entry.tokenId ?? "").trim();
+		const tokenSecret = (typeof entry.tokenSecret === "string" ? entry.tokenSecret : "").trim();
+		if (tokenId === "" || tokenSecret === "") return null;
+		const environment = (entry.environment ?? "").trim();
+		const key = `${tokenId}\u0000${environment}`;
 		const cached = this.gateways.get(entryId);
 		if (cached !== void 0 && cached.key === key) return cached.gateway;
 		cached?.gateway.close();
 		const gateway = new ModalSdkGateway({
-			tokenId: entry.tokenId.trim(),
-			tokenSecret: entry.tokenSecret.trim(),
-			environment: entry.environment.trim()
+			tokenId,
+			tokenSecret,
+			environment
 		});
 		this.gateways.set(entryId, {
 			key,
@@ -88665,6 +88746,19 @@ var TrainingModalAddon = class extends require_dist.BaseAddon {
 		cached.gateway.close();
 		this.gateways.delete(entryId);
 	}
+	/**
+	* Keychain views for the Providers edit form. Addon-facing reads answer
+	* VALUES (D798), so we cannot recover markers from `readStoredGlobalKey`.
+	* When a secret is present on the resolved entry we emit the deterministic
+	* keychain ref (`ctx.secrets.ref`) so `SecretFieldControl` can reveal.
+	*/
+	async readEntrySecretViews() {
+		const map = /* @__PURE__ */ new Map();
+		const secrets = this.ctx.secrets;
+		for (const entry of effectiveModalEntries(this.config)) map.set(entry.id, entryTokenSecretView(entry.tokenSecret, secrets, entry.id));
+		map.set("legacy-default", flatTokenSecretView(this.config.tokenSecret, secrets));
+		return map;
+	}
 	ledger() {
 		const state = () => {
 			if (this.ledgerState === null) throw new Error("training-modal ledger not initialised");

package/dist/providers/modal/training-modal.addon.mjs

@@ -1,4 +1,4 @@
-import { c as trainingProviderCapability, d as number, f as object, l as BaseAddon, m as string, p as record, u as boolean } from "../../dist-DhCvklZW.mjs";
+import { _ as number, b as string, c as trainingProviderCapability, d as arrayItemFieldPath, f as globalSecretScope, g as boolean, h as toSecretFieldView, l as BaseAddon, m as isSecretMarker, p as isSecretClear, u as SECRET_CLEAR, v as object, y as record } from "../../dist-CVDWIKl7.mjs";
 import { createRequire } from "node:module";
 import path, { dirname, posix } from "node:path";
 import { createHash, createPrivateKey, createPublicKey, createSign, randomBytes, randomUUID } from "node:crypto";
@@ -39,14 +39,43 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region src/providers/modal/modal-entries.ts
+//#region src/providers/modal/entry-secret-view.ts
 /**
-* Modal provider entries — one credentials + defaults row per operator
-* account. Pure helpers so the store is unit-tested without BaseAddon.
+* Build the {@link SecretFieldView} the Providers edit form needs for an
+* entry's token secret.
 *
-* A pre-multi-entry config (flat tokenId/tokenSecret on the addon) migrates
-* to a single entry named {@link DEFAULT_MODAL_ENTRY_NAME}.
+* `readStoredGlobalKey` / `this.config` answer VALUES (D798), never markers —
+* so `toSecretFieldView(plaintext)` alone yields an inline view (`$secret:
+* null`) and `SecretFieldControl` cannot reveal. When the secret is set we
+* prefer the deterministic keychain ref (`ctx.secrets.ref`) so the eye can
+* call `keychain-admin.reveal` (D789).
 */
+/** View for one entry row, or `null` when nothing is stored. */
+function entryTokenSecretView(tokenSecret, secrets, entryId) {
+	if (isSecretMarker(tokenSecret)) return toSecretFieldView(tokenSecret);
+	const plain = typeof tokenSecret === "string" ? tokenSecret.trim() : "";
+	if (plain === "") return null;
+	if (secrets === void 0) return toSecretFieldView(plain);
+	return {
+		$secret: secrets.ref(globalSecretScope(), arrayItemFieldPath("entries", entryId, "tokenSecret")),
+		v: 1,
+		set: true
+	};
+}
+/** View for the legacy flat `tokenSecret` (pre-multi-entry Default). */
+function flatTokenSecretView(tokenSecret, secrets) {
+	if (isSecretMarker(tokenSecret)) return toSecretFieldView(tokenSecret);
+	const plain = typeof tokenSecret === "string" ? tokenSecret.trim() : "";
+	if (plain === "") return null;
+	if (secrets === void 0) return toSecretFieldView(plain);
+	return {
+		$secret: secrets.ref(globalSecretScope(), "tokenSecret"),
+		v: 1,
+		set: true
+	};
+}
+//#endregion
+//#region src/providers/modal/modal-entries.ts
 var MODAL_TYPE_ID = "modal";
 var DEFAULT_MODAL_ENTRY_NAME = "Default";
 var MODAL_ICON_ASSET = "assets/training-modal/icon.svg";
@@ -57,22 +86,44 @@ var DEFAULT_GRACE = 24;
 function legacyConfigured(config) {
 	return (config.tokenId ?? "").trim() !== "" || (config.tokenSecret ?? "").trim() !== "";
 }
+/**
+* Keychain / secretStatePaths may omit an empty `tokenSecret` from a stored
+* row (writing `''` is KEEP, not "store empty"). Readers must never see
+* `undefined` and then call `.trim()`.
+*/
+function secretAsString(value) {
+	return typeof value === "string" ? value : "";
+}
+function normalizeModalEntry(entry) {
+	return {
+		id: entry.id,
+		name: entry.name ?? "Default",
+		tokenId: entry.tokenId ?? "",
+		tokenSecret: secretAsString(entry.tokenSecret),
+		environment: entry.environment ?? "",
+		gpuType: entry.gpuType ?? DEFAULT_GPU,
+		region: entry.region ?? "",
+		costCapUsd: entry.costCapUsd ?? DEFAULT_COST,
+		maxRuntimeHours: entry.maxRuntimeHours ?? DEFAULT_HOURS,
+		failedDatasetGraceHours: entry.failedDatasetGraceHours ?? DEFAULT_GRACE
+	};
+}
 /** Entries the operator sees — synthesises Default from legacy flat fields. */
 function effectiveModalEntries(config) {
-	if (config.entries.length > 0) return config.entries;
+	if (config.entries.length > 0) return config.entries.map((e) => normalizeModalEntry(e));
 	if (!legacyConfigured(config)) return [];
-	return [{
+	return [normalizeModalEntry({
 		id: "legacy-default",
 		name: DEFAULT_MODAL_ENTRY_NAME,
-		tokenId: config.tokenId ?? "",
-		tokenSecret: config.tokenSecret ?? "",
-		environment: config.environment ?? "",
-		gpuType: config.gpuType ?? DEFAULT_GPU,
-		region: config.region ?? "",
-		costCapUsd: config.costCapUsd ?? DEFAULT_COST,
-		maxRuntimeHours: config.maxRuntimeHours ?? DEFAULT_HOURS,
-		failedDatasetGraceHours: config.failedDatasetGraceHours ?? DEFAULT_GRACE
-	}];
+		tokenId: config.tokenId,
+		tokenSecret: config.tokenSecret,
+		environment: config.environment,
+		gpuType: config.gpuType,
+		region: config.region,
+		costCapUsd: config.costCapUsd,
+		maxRuntimeHours: config.maxRuntimeHours,
+		failedDatasetGraceHours: config.failedDatasetGraceHours
+	})];
 }
 function findModalEntry(config, entryId) {
 	return effectiveModalEntries(config).find((e) => e.id === entryId) ?? null;
@@ -409,7 +460,10 @@ var ModalTrainingProvider = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	describe = async () => this.deps.listEntries().map((entry) => this.descriptorOf(entry));
+	describe = async () => {
+		const views = await this.deps.secretViews();
+		return this.deps.listEntries().map((entry) => this.descriptorOf(entry, views.get(entry.id) ?? null));
+	};
 	describeTypes = async () => [{
 		typeId: MODAL_TYPE_ID,
 		label: "Modal",
@@ -425,10 +479,11 @@ var ModalTrainingProvider = class {
 	}));
 	createEntry = async (input) => this.deps.createEntry(input);
 	updateEntry = async (input) => {
+		const secret = input.tokenSecret === void 0 ? {} : isSecretClear(input.tokenSecret) ? { clearTokenSecret: true } : input.tokenSecret === "" ? {} : { tokenSecret: input.tokenSecret };
 		await this.deps.updateEntry(input.entryId, {
 			name: input.name,
 			...input.tokenId !== void 0 ? { tokenId: input.tokenId } : {},
-			...input.tokenSecret !== void 0 ? { tokenSecret: input.tokenSecret } : {},
+			...secret,
 			...input.environment !== void 0 ? { environment: input.environment } : {},
 			...input.gpuType !== void 0 ? { gpuType: input.gpuType } : {},
 			...input.region !== void 0 ? { region: input.region } : {},
@@ -715,9 +770,12 @@ var ModalTrainingProvider = class {
 		}))];
 	};
 	entryConfigured(entry) {
-		return entry.tokenId.trim() !== "" && entry.tokenSecret.trim() !== "";
+		const secret = typeof entry.tokenSecret === "string" ? entry.tokenSecret : "";
+		return (entry.tokenId ?? "").trim() !== "" && secret.trim() !== "";
 	}
-	descriptorOf(entry) {
+	descriptorOf(entry, tokenSecretView) {
+		const tokenId = entry.tokenId ?? "";
+		const environment = entry.environment ?? "";
 		return {
 			addonId: this.deps.addonId,
 			entryId: entry.id,
@@ -734,15 +792,16 @@ var ModalTrainingProvider = class {
 			dataResidencyNote: "Modal keeps the frames on a Volume of your workspace for the length of the job; the training container sees them only while it runs.",
 			configured: this.entryConfigured(entry),
 			defaults: {
-				gpuType: entry.gpuType,
-				region: entry.region,
-				costCapUsd: entry.costCapUsd,
-				maxRuntimeSec: Math.round(entry.maxRuntimeHours * 3600),
-				failedDatasetGraceHours: entry.failedDatasetGraceHours
+				gpuType: entry.gpuType ?? "L4",
+				region: entry.region ?? "",
+				costCapUsd: entry.costCapUsd ?? 5,
+				maxRuntimeSec: Math.round((entry.maxRuntimeHours ?? 4) * 3600),
+				failedDatasetGraceHours: entry.failedDatasetGraceHours ?? 24
 			},
-			tokenId: entry.tokenId,
-			environment: entry.environment,
-			hasTokenSecret: entry.tokenSecret.trim() !== ""
+			tokenId,
+			environment,
+			hasTokenSecret: tokenSecretView !== null,
+			tokenSecretView
 		};
 	}
 	requireGateway(entryId) {
@@ -88616,9 +88675,15 @@ var TrainingModalAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		let next = this.config;
-		if (next.entries.length === 0) next = migrateLegacyModalConfig(next, () => randomUUID());
+		let migratedLegacy = false;
+		if (next.entries.length === 0) {
+			const migrated = migrateLegacyModalConfig(next, () => randomUUID());
+			migratedLegacy = migrated !== next;
+			next = migrated;
+		}
 		next = ensureModalEntryIds(next, () => randomUUID());
 		if (next !== this.config) await this.updateGlobalSettings(next);
+		if (migratedLegacy) await this.clearSecrets(["tokenSecret"]);
 		this.ledgerState = this.state(LEDGER_KEY, LedgerSchema, {});
 		const peer = this.ctx.peerBytes;
 		if (peer === void 0) throw new Error("training-modal needs the peer-bytes facility");
@@ -88634,17 +88699,27 @@ var TrainingModalAddon = class extends BaseAddon {
 				return { entryId: result.entryId };
 			},
 			updateEntry: async (entryId, patch) => {
-				const result = updateModalEntry(this.config, entryId, patch);
+				const { clearTokenSecret, ...rest } = patch;
+				const result = updateModalEntry(this.config, entryId, rest);
 				if (!result.ok) throw new Error(`cannot update entry: ${result.reason}`);
-				await this.updateGlobalSettings(result.config);
+				if (clearTokenSecret === true) await this.updateGlobalSettings({
+					...result.config,
+					entries: result.config.entries.map((entry) => entry.id === entryId ? {
+						...entry,
+						tokenSecret: SECRET_CLEAR
+					} : entry)
+				});
+				else await this.updateGlobalSettings(result.config);
 				this.closeGateway(entryId);
 			},
 			deleteEntry: async (entryId) => {
 				const result = deleteModalEntry(this.config, entryId);
 				if (!result.ok) throw new Error(`cannot delete entry: ${result.reason}`);
 				await this.updateGlobalSettings(result.config);
+				await this.clearSecrets(["tokenSecret"]);
 				this.closeGateway(entryId);
 			},
+			secretViews: () => this.readEntrySecretViews(),
 			ledger: this.ledger(),
 			peer,
 			fetchText,
@@ -88653,7 +88728,10 @@ var TrainingModalAddon = class extends BaseAddon {
 		});
 		this.ctx.logger.info("Modal training provider ready", { meta: {
 			entries: effectiveModalEntries(this.config).length,
-			configured: effectiveModalEntries(this.config).some((e) => e.tokenId.trim() !== "" && e.tokenSecret.trim() !== "")
+			configured: effectiveModalEntries(this.config).some((e) => {
+				const secret = typeof e.tokenSecret === "string" ? e.tokenSecret : "";
+				return (e.tokenId ?? "").trim() !== "" && secret.trim() !== "";
+			})
 		} });
 		return { providers: [{
 			capability: trainingProviderCapability,
@@ -88671,15 +88749,18 @@ var TrainingModalAddon = class extends BaseAddon {
 	gatewayFor(entryId) {
 		const entry = findModalEntry(this.config, entryId);
 		if (entry === null) return null;
-		if (entry.tokenId.trim() === "" || entry.tokenSecret.trim() === "") return null;
-		const key = `${entry.tokenId}\u0000${entry.environment}`;
+		const tokenId = (entry.tokenId ?? "").trim();
+		const tokenSecret = (typeof entry.tokenSecret === "string" ? entry.tokenSecret : "").trim();
+		if (tokenId === "" || tokenSecret === "") return null;
+		const environment = (entry.environment ?? "").trim();
+		const key = `${tokenId}\u0000${environment}`;
 		const cached = this.gateways.get(entryId);
 		if (cached !== void 0 && cached.key === key) return cached.gateway;
 		cached?.gateway.close();
 		const gateway = new ModalSdkGateway({
-			tokenId: entry.tokenId.trim(),
-			tokenSecret: entry.tokenSecret.trim(),
-			environment: entry.environment.trim()
+			tokenId,
+			tokenSecret,
+			environment
 		});
 		this.gateways.set(entryId, {
 			key,
@@ -88693,6 +88774,19 @@ var TrainingModalAddon = class extends BaseAddon {
 		cached.gateway.close();
 		this.gateways.delete(entryId);
 	}
+	/**
+	* Keychain views for the Providers edit form. Addon-facing reads answer
+	* VALUES (D798), so we cannot recover markers from `readStoredGlobalKey`.
+	* When a secret is present on the resolved entry we emit the deterministic
+	* keychain ref (`ctx.secrets.ref`) so `SecretFieldControl` can reveal.
+	*/
+	async readEntrySecretViews() {
+		const map = /* @__PURE__ */ new Map();
+		const secrets = this.ctx.secrets;
+		for (const entry of effectiveModalEntries(this.config)) map.set(entry.id, entryTokenSecretView(entry.tokenSecret, secrets, entry.id));
+		map.set("legacy-default", flatTokenSecretView(this.config.tokenSecret, secrets));
+		return map;
+	}
 	ledger() {
 		const state = () => {
 			if (this.ledgerState === null) throw new Error("training-modal ledger not initialised");

package/dist/remoteEntry.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-dy7yMOdw.mjs";
+import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-Dw400Y0a.mjs";
 export { t as get, e as init };

package/dist/{responsive-C7QsFtTb.mjs → responsive-BBlQWFFi.mjs}

@@ -1,5 +1,5 @@
 import { _ as e, b as t, c as n, g as r, l as i, m as a, n as o, r as s, t as c, u as l } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react__loadShare__.js-BT_wL8s3.mjs";
-import { i as u } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-D7T4QEtw.mjs";
+import { a as u } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-ff7X-Xlf.mjs";
 import "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DDBEvLdo.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
 t();

package/dist/{scene-monitor-copy-BtffdnnW.mjs → scene-monitor-copy-D5mKGqt0.mjs}

@@ -1,5 +1,5 @@
 import { b as e, c as t, g as n, m as r } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react__loadShare__.js-BT_wL8s3.mjs";
-import { y as i } from "./responsive-C7QsFtTb.mjs";
+import { y as i } from "./responsive-BBlQWFFi.mjs";
 var a = i("camera", [["path", {
 	d: "M13.997 4a2 2 0 0 1 1.76 1.05l.486.9A2 2 0 0 0 18.003 7H20a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V9a2 2 0 0 1 2-2h1.997a2 2 0 0 0 1.759-1.048l.489-.904A2 2 0 0 1 10.004 4z",
 	key: "18u6gg"

package/dist/{square-e5Ytjod_.mjs → square-D0FYSm8b.mjs}

@@ -1,4 +1,4 @@
-import { y as e } from "./responsive-C7QsFtTb.mjs";
+import { y as e } from "./responsive-BBlQWFFi.mjs";
 var t = e("eye-off", [
 	["path", {
 		d: "M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",

package/dist/{trash-2-Clte6zIF.mjs → trash-2-DdjGvgDw.mjs}

@@ -1,4 +1,4 @@
-import { y as e } from "./responsive-C7QsFtTb.mjs";
+import { y as e } from "./responsive-BBlQWFFi.mjs";
 var t = e("trash-2", [
 	["path", {
 		d: "M10 11v6",

package/dist/{virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-dy7yMOdw.mjs → virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-Dw400Y0a.mjs}

@@ -2753,7 +2753,7 @@ async function rr(e) {
 	}
 }
 async function ir() {
-	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_training_page-DJDgoXBt.mjs")).catch((e) => {
+	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_training_page-DKblQaAP.mjs")).catch((e) => {
 		throw tr = void 0, e;
 	}), tr;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-training",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Cloud training for CamStack: fine-tune the root detector on your own frames, on your own GPU-cloud account",
   "keywords": [
     "camstack",